Overview

overview

10

Static

static

10

b749e9cd50...28.apk

android-9-x86

10

b749e9cd50...28.apk

android-10-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    19-11-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b749e9cd50b8cb27cbe5852cf7de1617a5352f10a8cbbd5fa59a6701e95cc128.apk

  • Size

    2.7MB

  • MD5

    3bdefac377fff4648c42aa7cd94833ab

  • SHA1

    9adb17653e486f5581b87a970ffd607178334faf

  • SHA256

    b749e9cd50b8cb27cbe5852cf7de1617a5352f10a8cbbd5fa59a6701e95cc128

  • SHA512

    44d73733521766167b8c3712db2036313798614d878f3ff2d60f09c2543ecef6ec1da2280cebb9046867461304d78eb29b089f4ab27ec231777c2215efffa6c4

  • SSDEEP

    49152:B86Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQV:yFjEI4iZaUzYH99yIS

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://178.215.224.87:7117/gate/

https://178.215.224.87:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://178.215.224.87:80/builderxxxzzz/gate/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    c9e2c5ffc30284669ec26bb7fa91f498

    SHA1

    dc85e43c746424ea4c497ac305e6c15ddb479a04

    SHA256

    361e111f649d93512e2af085f9c91cac3735287611974090c5a628b7bcc94f53

    SHA512

    3cfc09076a21741108bca88ae11808cc4f4233b94a39888d634c678dc42b7b0ea401b4429f79959d23224eb2812ec64c9a50224d12e15ccb663b7d58e234a253

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    54B

    MD5

    5f503c1b318e97523feae2027ef20e8b

    SHA1

    f75ce67cf290e149905f068f01f239beebad5e84

    SHA256

    5588ee1fa0e945c0827db8e741d44954f384dc8537edc49bde3c5ba31eaa466f

    SHA512

    e37c1690be133e667cf6c92a70dedda8c1d87b7843cb0cb296876262db19d788151815ee90d901bc514c005f298a97d6814576eaf2ba77e60a9975b848341c05

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    e567b90e1f31d69275eb75ee612d6c18

    SHA1

    b0cfde816748777b86cfc4937cc98ddd033916dd

    SHA256

    68fe511329c226bc32aed4862d8adb8c45bc8ed9a77e26131fd598c8b72198a1

    SHA512

    7aefb3ecc75a5e3648d4f366ea46903b697ce87ea6f534c2c3fa4ba670e9bed41b33af1c606097f398f02593cfc4caaceaf969319784d08b62830affbeefba73

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    d64d522b8eef0bae86efcfd1a1cd8454

    SHA1

    601048535af24cb61177650a2d6564958e4693f6

    SHA256

    f7b23ebd270384b8ec198de1d3575d9eb43dea6d9cf01c3d35403e65ae93cac6

    SHA512

    bc71160e6cc1c6bd774a118c17f9de33bb609c673ddb51354b794c3800e69ae50e19ce42b0c8d9e34798e76b3fdd508f49956187c78cffbd1555bccfda3e300f

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    423B

    MD5

    4b2e2e83745ea547fbebb974669a3021

    SHA1

    ffa7f60ca88f42d046f9889d6e93f7101284f777

    SHA256

    3c4ebf639053b3f2e1c30062990f7aa125f31e3d5152b3c033a2b925c9ab6629

    SHA512

    04f4cecfdb83324399eec2558e6dbc1f2d004e12f259a2c54740d7c252cb91aff18a9d521e3483ed84cb14a6adb5595e90c17ec1d368a4d48c776e0b0cb949b9

    Download Submit